CCSP Practice Test 27 — 15 Questions

Question 1

A cloud customer is concerned about the risk of unauthorized access to data due to the shared infrastructure of a public cloud. What type of risk does this represent?

Accepted Answer

Inherent risk. Inherent risk is the risk that exists before any controls are applied; shared infrastructure is a key inherent risk of cloud computing.

Answer

Control risk

Answer

Detection risk

Answer

Residual risk

Question 2

A company is negotiating a cloud service agreement and wants to ensure it can verify the provider's security controls independently. Which contractual clause is essential for this purpose?

Accepted Answer

Right to audit clause. A right to audit clause gives the customer the contractual ability to assess the provider's controls, either through on-site audits or review of audit reports.

Answer

Data deletion clause

Answer

Service Level Agreement (SLA) on uptime

Answer

Data portability clause

Question 3

In the context of eDiscovery, a legal hold must be placed on data stored in a cloud environment. Which THREE actions should the cloud customer take to ensure the legal hold is effective?

Accepted Answer

Ensure the legal hold prevents both deletion and modification of the data.. A legal hold requires preserving all relevant data, including backups and replicas. It must also prevent modification, not just deletion. Communication with the provider ensures technical enforcement.

Answer

Delete any non-relevant data to reduce storage costs.

Answer

Rely solely on the cloud provider's default backup retention policies.

Question 4

A cloud customer is selecting a cloud provider for hosting payment card data and must comply with PCI DSS. Which THREE of the following are valid considerations when assessing the provider's PCI DSS compliance?

Accepted Answer

The provider must have a Cloud Provider Responsibility Matrix. PCI DSS allows cloud providers to be assessed by a QSA. Shared responsibility must be clearly defined. The provider may have a Responsibility Matrix as per Appendix A3.

Answer

The provider must sign a Business Associate Agreement

Answer

The cloud provider must be a Level 1 service provider

Question 5

A cloud customer receives a litigation hold notice requiring preservation of data stored in an object storage service. Which service feature should the customer use to ensure data cannot be modified or deleted until the hold is released?

Accepted Answer

Apply a retention policy using Object Lock. Object lock features like S3 Object Lock enable a write-once-read-many (WORM) model to prevent deletion or modification, meeting legal hold requirements.

Answer

Set a lifecycle policy to transition to archival storage

Answer

Enable versioning on the bucket

Answer

Configure server-side encryption

Question 6

A multinational corporation is implementing a multi-cloud strategy to avoid concentration risk. The risk management team is evaluating the inherent risks of using multiple cloud providers. Which THREE risks are specifically associated with a multi-cloud strategy? (Choose three.)

Accepted Answer

Expanded attack surface due to more entry points and APIs. Multi-cloud strategies introduce complexity in managing different security models, increase the attack surface, and require expertise across multiple platforms. Vendor lock-in is reduced, not increased, and data sovereignty issues are not inherently worse than single-cloud.

Answer

Higher likelihood of vendor lock-in due to proprietary services

Answer

Greater difficulty in meeting data sovereignty requirements across jurisdictions

Question 7

A company is using a single cloud provider for all critical services. What is the primary risk this company faces?

Accepted Answer

Concentration risk. Concentration risk (vendor lock-in) arises from over-reliance on one provider, leading to potential business disruption if the provider fails.

Answer

Data sovereignty risk

Answer

Compliance risk

Answer

Insider threat risk

Question 8

A company is moving a legacy application to the cloud. The application uses hard-coded passwords for database connections. Which secure development practice should be implemented to address this issue?

Accepted Answer

Secrets management. Hard-coded passwords in application code violate the principle of least privilege and create a persistent security risk if the code is exposed. Secrets management (D) addresses this by storing database credentials in a secure, centralized vault (e.g., HashiCorp Vault, AWS Secrets Manager) and retrieving them at runtime via API calls, eliminating the need to embed passwords in source code or configuration files.

Answer

Multi-factor authentication

Answer

Input validation

Answer

Encryption at rest

Question 9

A security engineer is investigating a potential data exfiltration incident involving an Amazon S3 bucket. Which set of logs would provide the most relevant information to identify the source IP and API calls made to the bucket?

Accepted Answer

AWS CloudTrail data events for the S3 bucket. S3 access logs record details of requests made to an S3 bucket, including the requester's IP and the operation performed. CloudTrail data events also capture S3 API calls at the object level. VPC Flow Logs show network traffic but not API calls. CloudWatch logs could contain application logs but are not specific to S3 access.

Answer

VPC Flow Logs for the subnet where the bucket resides

Answer

AWS Config configuration history for the S3 bucket

Answer

Amazon CloudWatch Logs for the EC2 instance accessing the bucket

Question 10

A company uses a cloud-based database that contains personally identifiable information (PII). They need to allow developers to run queries against the database for testing purposes without exposing actual PII. Which technique should they use?

Accepted Answer

Apply dynamic data masking to the PII columns. Dynamic data masking (DDM) allows the database to return masked PII to developers in real time without altering the underlying stored data. This technique applies masking rules at query runtime, so developers can run functional tests against production-like data while sensitive values are obfuscated. It avoids the need for separate sanitized copies and preserves referential integrity for testing.

Answer

Encrypt the PII fields at rest

Answer

Grant developers direct access to a copy of the production data

Answer

Tokenize the PII fields with a one-way hash

Question 11

Which of the following is a cloud-specific threat that should be included in a threat model for a cloud application?

Accepted Answer

Exposed S3 bucket. Exposed S3 buckets are a common cloud-specific misconfiguration leading to data breaches. Other options are general security issues not unique to cloud.

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

Buffer overflow

Question 12

Your company, a global e-commerce platform, operates on a multi-cloud environment with workloads in AWS and Azure. You are the lead cloud architect. The platform experiences peak traffic during promotional events, with traffic spikes up to 10x normal. The application is composed of microservices running in containers orchestrated by Kubernetes on both clouds. Each cloud provider's Kubernetes cluster uses cluster autoscaler and horizontal pod autoscaler. Recently, during a flash sale, the AWS cluster failed to scale adequately, causing latency spikes and timeouts. AWS support indicated that the cluster hit a service quota limit for EC2 instances. You need to prevent this from recurring. You have the following options: A) Implement a multi-region deployment on AWS to distribute load. B) Pre-warm the AWS environment by requesting a service quota increase and using a pod priority class to ensure critical pods scale first. C) Migrate all workloads to Azure to simplify management. D) Use a global load balancer to route traffic to the cloud with the most available capacity. Which option is the best course of action?

Accepted Answer

Pre-warm the AWS environment by requesting a service quota increase and using a pod priority class to ensure critical pods scale first.. The root cause is a hard AWS service quota for EC2 instances, which prevents the cluster autoscaler from launching new nodes. Requesting a quota increase removes this bottleneck, while pod priority classes ensure that critical microservices are scheduled first when resources are constrained, preventing latency spikes during flash sales.

Answer

Implement a multi-region deployment on AWS to distribute load.

Answer

Migrate all workloads to Azure to simplify management.

Answer

Use a global load balancer to route traffic to the cloud with the most available capacity.

Question 13

Refer to the exhibit. A cloud administrator sees this error log from AWS CloudTrail. The user [email protected] is a member of the 'Analysts' group. Which of the following is the most likely cause of the AccessDenied error?

Accepted Answer

The IAM policy attached to the user or group does not include s3:PutObject for that bucket.. The AccessDenied error for an s3:PutObject operation indicates that the IAM policy attached to the user or group does not grant the necessary permissions. Since the user is a member of the 'Analysts' group, the most likely cause is that the group's IAM policy lacks an Allow effect for s3:PutObject on the target bucket. AWS IAM evaluates both identity-based and resource-based policies, and if no explicit Allow is present, the default implicit deny applies.

Answer

The user is trying to access the bucket from a different AWS region.

Answer

The bucket policy explicitly denies access to the 'Analysts' group.

Answer

The bucket requires server-side encryption and the request did not include encryption headers.

Question 14

A company uses a cloud key management service with automatic annual key rotation. An auditor requires that keys are rotated every 90 days to meet internal policy. What should the cloud security architect do to satisfy this requirement?

Accepted Answer

Configure the cloud KMS with a custom rotation period of 90 days.. Cloud KMS services (e.g., AWS KMS, Azure Key Vault, GCP Cloud KMS) allow administrators to define a custom rotation period, overriding the default annual rotation. By configuring a 90-day rotation schedule, the architect directly meets the auditor's policy without manual intervention or exceptions, ensuring automated compliance.

Answer

Create a manual process to rotate keys every 90 days using scripts.

Answer

Request an exception from the auditor because the default annual rotation is sufficient.

Answer

Disable automatic rotation and rotate keys manually when needed.

Question 15

A company uses an Infrastructure as a Service (IaaS) provider for critical applications. They need to define a backup retention policy that meets regulatory requirements for keeping financial records for 7 years. Which of the following strategies best meets this requirement while optimizing costs?

Accepted Answer

Perform daily backups, keep weekly backups for 3 months, monthly for 1 year, and yearly for 7 years in cold storage.. It implements a tiered backup retention strategy that aligns with the 7-year regulatory requirement while minimizing storage costs. By transitioning weekly backups to cold storage after 3 months, monthly backups after 1 year, and yearly backups for the full 7 years, the company reduces the cost of storing infrequently accessed data. This approach leverages the IaaS provider's lifecycle management policies (e.g., AWS S3 Lifecycle or Azure Blob Storage access tiers) to automatically move backups to lower-cost storage classes like Glacier or Archive, which are optimized for long-term retention.

Answer

Perform daily full backups and retain all backups for 7 years.

Answer

Replicate all backups to a secondary region with snapshots kept for 7 years.

Answer

Use a grandfather-father-son rotation scheme with weekly, monthly, and yearly backups.